Skill UI

Detects abnormal AWS S3, GCS, and Azure Blob access by analyzing CloudTrail, GCS audit logs, and Storage Analytics, flagging after-hours bulk downloads, new IPs, reconnaissance spikes, and exfiltration risks.

Detect suspicious API usage in AWS CloudTrail by querying events with boto3, building statistical baselines, and flagging anomalies such as new event sources, geographic shifts, frequent failures, and sensitive IAM/KMS/S3 calls to surface potential credential compromise or insider threat activity.

Detect S3 data exfiltration by correlating CloudTrail data events, GuardDuty findings, Macie alerts, and access patterns to flag bulk downloads or cross-account transfers.

Implements AWS CloudTrail log analysis with Athena, CloudWatch Logs Insights, and SIEM feeds to monitor API activity, detect privilege escalation, unauthorized access, and support forensic investigations across AWS environments.

Defines security chaos engineering experiments that intentionally break controls—opening security groups, disabling CloudTrail, creating admin IAM users, disrupting log pipelines, and staging malware hashes—to validate SOC detection, alerting, and response.

Use boto3, Athena, and the AWS CLI to query CloudTrail logs, reconstruct attacker timelines, surface suspicious API calls and credential abuse, then craft forensic reports for AWS incident response.

Guides teams through auditing Lambda execution roles, analyzing CloudTrail/Access Analyzer data, crafting least-privilege IAM policies, applying permission boundaries, and scoping roles with SCPs to lock down serverless access.